A method for converting from RSML -e to Luster synchronous dataflow language

Abstract

The application discloses a conversion method and system from RSML ‑e model to Luster synchronous data flow language. ‑e The method converts RSML ‑e model into Luster, which involves type conversion, Boolean expression conversion, and-or table conversion, variable conversion, macro conversion and function conversion. Type conversion handles undefined values by creating enumerations and structs. Boolean expression conversion includes truth judgment, logical negation, previous state reference and equality judgment. and-or table conversion constructs sub-expressions by columns and connects them with logical or. Variable conversion is converted into Luster nodes, and ordinary variables and input variables are processed with initial values and conditions respectively. Macro and function conversion are converted into nodes with input and return values, and the contained logic is converted into Boolean expressions. The overall process realizes the mapping of RSML ‑e logic to Luster data flow, so that the safety properties of the system can be verified using model checking tools, improving system security.

Description

Technical Field

[0001] This invention belongs to the field of system security and reliability technology, specifically relating to a method for obtaining data from RSML. -e A method and system for converting the model to the Luster synchronous data stream language. Background Technology

[0002] Model checking is a formal verification technique that allows for the exhaustive exploration of a model's state space to detect properties such as safety, liveness, and functionality, making the detection of properties highly automated and simplified.

[0003] Formal analysis begins with formal specification languages. RSML (Requirements State Machine Language) is a state-based specification language commonly used in software development, systems engineering, and automation control. Based on state machine theory, it precisely describes the functional and performance requirements of a system by defining its various states, the transition conditions between states, and the behavior and output in each state. -e It is developed based on the RSML language, and its main difference from RSML lies in RSML. -e The RSML (Required Mode Model) is a stringent specification supporting interaction between the environment and control software. It is used by NASA to describe the requirements model for mode transitions in automated flight systems. Automated flight systems are the core system of modern large aircraft flight control; flight mode transitions determine the flight control process. The safety verification of mode transition requirements is a significant challenge in the development of automated flight systems, hence the importance of RSML. -e Verifying the safety properties of the model is very important.

[0004] Although RSML -e It has excellent readability and comprehensibility, making it a great communication tool between non-professionals and professionals, but RSML... -e It is not executable; use RSML. -e The established model cannot be validated. Furthermore, the state-space explosion problem limits the size of the analyzable model. Therefore, in order to practically test the system's security properties, it is necessary to transform it into a suitable verifiable model.

[0005] A model built using the Luster synchronous dataflow language is a verifiable model. Furthermore, when verifying a model built using the Luster synchronous dataflow language, methods such as Bounded Model Check (BMC) and Attribute Directed Reachability (PDR) can be applied to alleviate the state explosion problem that may occur during attribute verification to some extent.

[0006] The JKind Model Checker is a model checking tool for the Luster synchronous dataflow language, which is an open-source, industrial-strength model checker. JKind uses multiple parallel engines applied to a model with an infinite number of states to prove properties or give counterexamples. The structure of JKind is several parallel engines that coordinate to prove properties, mimicking the design of PKind and Kind 2. Some engines are directly responsible for proving properties, others assist this work by generating invariants, and others are reserved for post-processing of the proof or counterexample results. Each engine can be individually enabled or disabled as needed by the user. Referring to Figure 1 The bounded model checking (BMC) engine performs a standard iterative unfolding of the transition relation to find counterexamples and serves as the base case for k-induction. The BMC engine guarantees that any counterexample it finds is minimal in length; the k-induction (k-Induction) engine performs the induction step of k-induction, possibly using invariants generated by other engines; the invariant generation (Inv Gen) engine uses a template-based invariant generation technique, using its own k-induction loop; the property-directed reachability (PDR) engine performs property-directed reachability using an implicit abstraction technique. Unlike BMC and k-induction, each property is handled separately by a different PDR sub-engine. Finally, the advice (Advice) engine generates invariants based on previous runs of JKind.

[0007] Therefore, in order to be able to actually detect the safety properties of the system, it is necessary to study the conversion from the RSML -e model to the Luster synchronous dataflow language. SUMMARY

[0008] The purpose of the present application is to provide a conversion method and system from the RSML -e model to the Luster synchronous dataflow language.

[0009] Technical scheme: In order to achieve the above-mentioned purpose of the application, the technical scheme adopted by the present application is as follows:

[0010] In a first aspect, a conversion method from the RSML -e model to the Luster synchronous dataflow language, comprising the following steps:

[0011] analyzing the RSML -e model, converting the RSML -e model into the basic units of the Luster synchronous dataflow language, determining the types, Boolean expressions, and-or tables, variables, macros and functions;

[0012] Perform type conversion; for Boolean and enumeration types, create a new enumeration type containing RSML. -e The primitive values ​​and specific enumeration values ​​represent undefined values; for integer and real numbers, a structure type with two elements is created, one element is an enumeration type indicating whether the value is defined, and the other element stores the actual numerical value;

[0013] Perform Boolean expression transformation, RSML -e Boolean variables in the code are directly converted to truth values ​​in Luster; RSML is then used for truth evaluation. -e Logical NOT in RSML is converted to falsity judgment in Luster; -e PREVIOUS STEP in RSML is translated into a pre() function call in Luster to reference the state of the previous step; -e Converting variable comparisons in RSML to equality checks in Luster, RSML -e The "When" condition in Luster is also represented as an equality check;

[0014] Perform AND-OR table conversion, converting RSML -e The Boolean variables or expressions in the table are converted into Boolean expressions in Luster. The AND-OR table is traversed column by column, and a sub-expression is constructed for each column. The sub-expression is formed by connecting the Boolean expressions of the corresponding row or their logical NOTs through a logical AND. The sub-expressions of all columns are connected through a logical OR to form the final Luster Boolean expression.

[0015] Perform variable transformations. For ordinary variables, convert them into Luster nodes with input parameters, and use the -> symbol and if-else statements to assign initial values ​​and conditions. If state transitions are involved, include the value of the previous state as the condition. For input variables, create a Luster node for it and use the input parameters of the main node as the input parameters of this node.

[0016] Perform macro and function conversion for RSML -e The macros and functions define Luster nodes, which contain input parameters and return values. They convert the AND-OR table logic within the macros and functions into Luster Boolean expressions and assign the result of the Boolean expression to the node's return value.

[0017] Furthermore, when performing type conversion, for boolean types, the new enumeration type uses True and False with the first letter capitalized; for enumeration types, the enumeration values ​​in the original enumeration type are added to the new enumeration type with the first letter swapped; for undefined types, different suffixes are added after Undefined to represent specific undefined enumeration values, and these are added to the new enumeration type.

[0018] Further, when performing and-or table conversion, the and-or table is traversed by column, and a sub-expression is constructed for each column, including:

[0019] The and-or table is traversed by column, and a Boolean expression in the form of expr 1＝ A1 and not A2 and A3......and not A n , expr 2＝ not A1 and A2 and notA3......and A n is formed according to the Boolean expression of the first column corresponding to True or False of each column.

[0020] Further, all column sub-expressions are connected by logical or, including:

[0021] All sub-expressions are connected by or to form a Boolean expression in the form of expr1 or expr2......or expr n .

[0022] Further, the variable conversion also includes: instantiating the converted normal variable and input variable nodes in the master node of Luster.

[0023] Further, the macro and function conversion also includes: referencing and instantiating the converted macro and function nodes in the master node of Luster.

[0024] Further, the method also includes: in the if-else conditional structure of Luster, the condition of the parent variable is taken as the primary judgment condition, and the value of the child variable or macro is calculated or assigned according to the subsequent conditions only when the parent variable condition is satisfied, and when the parent variable condition is not satisfied, the default value Undefined is set for the child variable or macro.

[0025] In a second aspect, a conversion system from an RSML -e model to a Luster synchronous data flow language includes:

[0026] A conversion unit determination module is configured to analyze the RSML -e model, and convert the RSML -e model to the basic units of the Luster synchronous data flow language, which are determined as types, Boolean expressions, and-or tables, variables, macros, and functions.

[0027] A type conversion module is configured to perform type conversion, and for Boolean and enumeration types, a new enumeration type is created, which contains RSML -eThe original value in RSML and the special enumeration value representing undefined are represented by a structure type containing two elements, one element is an enumeration type indicating whether the value is defined, and the other element stores the actual numerical value;

[0028] Boolean expression conversion module for performing Boolean expression conversion, RSML -e Boolean variable in RSML is directly converted to true value judgment in Luster; the logical NOT in RSML -e is converted to false value judgment in Luster; the PREVIOUS STEP in RSML -e is converted to pre() function call in Luster to refer to the state of the previous step; the variable comparison in RSML -e is converted to equivalence judgment in Luster, and the When condition judgment in RSML -e is also expressed as equivalence judgment in Luster;

[0029] and-or table conversion module for performing and-or table conversion, RSML -e Boolean variable or expression in RSML is converted to Boolean expression in Luster, the and-or table is traversed column by column, a sub-expression is constructed for each column, which is composed of the Boolean expression of the corresponding row or its logical NOT connected by logical AND; the sub-expressions of all columns are connected by logical OR to form the final Luster Boolean expression;

[0030] Variable conversion module for performing variable conversion, for ordinary variables, it is converted to a Luster node with input parameters, using -> symbol and if-else statement for initial value and conditional assignment, if state conversion is involved, the value of the previous state is included as a condition; for input variables, a Luster node is established, and the input parameters of the main node are used as the input parameters of this node;

[0031] Macro and function conversion module for performing macro and function conversion, Luster nodes are defined for macros and functions of RSML -e , including input parameters and return values, and the and-or table logic in the macro and function is converted to Luster Boolean expression, and the Boolean expression result is assigned to the return value of the node.

[0032] In a third aspect, a computer device includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the program is implemented when executed by the processor to realize the RSML -eSteps of the model-to-Luster synchronous dataflow language conversion method.

[0033] In a fourth aspect, a computer readable storage medium has stored thereon a computer program which, when executed by a processor, implements the method for converting a RSML -e Steps of the model-to-Luster synchronous dataflow language conversion method.

[0034] Advantages: The present application provides a method for converting a RSML -e model to a Luster synchronous dataflow language, according to the respective syntax characteristics of the RSML -e model and the Luster synchronous dataflow language, types, conditions, variables, macros, functions and the like defined in the RSML -e model are converted into the Luster synchronous dataflow language format, i.e., the RSML -e model is converted into the Luster synchronous dataflow language, so that the safety properties of a system can be verified using a model checking (such as The JKIND Model Checker) tool, and the state explosion problem is mitigated to a certain extent by using the built-in BMC engine and PDR engine of The JKIND Model Checker, incorrect or ambiguous requirements in the requirements are found out, and the safety of the system is improved. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 is a JKind engine structure diagram;

[0036] Figure 2 is a flowchart of the conversion method of the present application;

[0037] Figure 3 is a RSML model corresponding to the type Base_State in the embodiment of the present application; -e

[0038] Figure 4 is a RSML model corresponding to the macro When_Turn_FD_On in the embodiment of the present application; -e

[0039] Figure 5 is a RSML model corresponding to the state variable NAV in the embodiment of the present application; -e

[0040] Figure 6 is a RSML model corresponding to the input variable Offside_FGS_Active in the embodiment of the present application; -e

[0041] Figure 7 ​​​​The Jkind verification result in the embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0043] With reference to Figure 2 The embodiment of the present application provides a conversion method from an RSML -e model to a Luster synchronous data flow language, comprising the following steps:

[0044] Step one, analyzing the RSML -e model, determining the basic units of the RSML -e model converted into the Luster synchronous data flow language, so as to facilitate the subsequent conversion of different units.

[0045] Specifically, the RSML -e model supported by the RSML -e language is a synchronous data flow language, and the language specification thereof includes variables, functions, macros and the like. The input variable is used to record the value observed in the environment; the state variable is defined in a hierarchical form and is used to simulate various states of the control model; and the encapsulation of the function and the macro provides readability and ease of use for the user.

[0046] The RSML -e language and the Luster synchronous data flow language both support basic variable types. The RSML -e language uses undefined value to support uncertainty modeling. In the definition of the initial value of the state variable, if the user cannot know the initial state of the environment or the initial state of the environment is uncertain, so that the value of the state variable is unknown, the user can define the initial value of the state variable as undefined to support the subsequent state change. The Luster synchronous data flow language does not have such a mechanism built-in, so in order to make the conversion clear, the present application converts the type as a unit separately.

[0047] The RSML -e model variables, functions and macros contain a large number of judgment conditions, which are in the form of Boolean expressions or and-or tables. Because the Boolean expression has multiple types and the conversion of the and-or table is relatively complex, in order to make the conversion clear, the present application converts the Boolean expression and the and-or table as a unit separately.

[0048] After the above analysis, the RSML -eThe basic units of the model converted into the Luster synchronous dataflow language are determined to be types, Boolean expressions, and-or tables, variables, macros and functions.

[0049] Step two, according to the proposed conversion method, the RSML -e Each basic unit of the model is converted into the Luster synchronous dataflow language. According to the embodiment of the present application, the RSML -e The conversion of the model into the Luster synchronous dataflow language includes the conversion of types, the conversion of Boolean expressions, the conversion of and-or tables, the conversion of variables, the conversion of macros and functions and the handling of the flattening problem.

[0050] (1) For types, the RSML -e Supports the use of undefined values, the Luster synchronous dataflow language does not support the use of undefined values. Therefore the conversion of the types includes the following: the RSML -e The data types supported by the model are converted into the basic data types supported by the Luster synchronous dataflow language.

[0051] According to the embodiment of the present application, the RSML -e The data types supported by the model are converted into the basic data types supported by the Luster synchronous dataflow language, including: for the Boolean type and the enumeration type, creating a new enumeration type containing the original values of the RSML -e and a specific enumeration value representing undefined. For the integer type and the real type, a structure type containing two elements is created, one element is an enumeration type indicating whether the value is defined, and the other element stores the actual numerical value.

[0052] Specifically, for the Boolean type and the enumeration type, we keep the original Boolean type and the enumeration type, and newly create an enumeration type, put undefined as an enumeration value into the newly created enumeration type together with true, false or the original enumeration value, to represent the RSML -ecorresponding semantics. It should be noted that the enumeration values of different enumeration types in Luster are not allowed to be repeated, while the present application needs to keep the original enumeration type as the input parameter of the master node, so true, false and the enumeration values in the original enumeration type cannot be used in the newly created enumeration type, and undefined cannot appear in different enumeration types. Therefore, True and False with the first letter capitalized are used in the new enumeration type here; for the enumeration values in the original enumeration type, the first letter is interchanged in capitalization to be added to the new enumeration type; for undefined, different suffixes are added after it to become Undefined_bool, Undefined_enum1, Undefined_enum2 and be added to the new enumeration type. For example, the converted Boolean type is type bool2=enum{True,False,Undefined_bool}.

[0053] For integer or real types, a new structure type containing two elements is created, one of which is an enumeration type {Undefined_int, Defined_int} or {Undefined_real, Defined_real} to store whether it is defined, and the other element is an integer or real type to store the original integer or real type.

[0054] (2) For Boolean expressions, RSML -e contains different forms of Boolean expressions. Therefore, the following contents are included in the conversion of Boolean expressions: the Boolean expression of the RSML -e model is converted into the Boolean expression of the Luster synchronous data flow language.

[0055] According to the embodiment of the present application, the Boolean expression of the RSML -e model is converted into the Boolean expression of the Luster synchronous data flow language, which includes: the Boolean variable in RSML -e is directly converted into the truth value judgment in Luster; the logical NOT in RSML -e is converted into the false value judgment in Luster; the PREVIOUS STEP in RSML -e is converted into the pre() function call in Luster to refer to the state of the previous step; the variable comparison in RSML -e is converted into the equivalence judgment in Luster, and the When conditional judgment in RSML -e is also expressed as the equivalence judgment in Luster.

[0056] Specifically, assuming that there is a Boolean variable a, and the variable A after type conversion; other type variables b, c, and the variables B, C after type conversion. RSML-e The form of the judgment condition in the RSML model is: a, not a, PREVIOUS STEP(a), b=c, PREVIOUS STEP(b)=c, When(b=c). For a, the converted Boolean expression is A=True; for not a, the converted Boolean expression is A=False; for PREVIOUS STEP(a), the converted Boolean expression is pre(A)=True; for b=c, the converted Boolean expression is B=C; for PREVIOUS STEP(b)=c, the converted Boolean expression is pre(B)=C; for When(b=c), the converted Boolean expression is B=C.

[0057] (3) For the and-or table, the RSML -e The condition is usually expressed by an and-or table in the RSML model. The rows and columns of the and-or table represent and (and) and or (or) relationships respectively, and in addition, there is a column of Boolean variables or Boolean expressions in front of the and-or table, and each cell in the and-or table represents whether the related Boolean variable or Boolean expression is true or false, T representing true and F representing false. Therefore, the conversion of the and-or table includes the following contents: converting the and-or table in the RSML -e model into a Boolean expression of the Luster synchronous data flow language.

[0058] According to the embodiment of the present application, the conversion of the and-or table in the RSML -e model into a Boolean expression of the Luster synchronous data flow language includes: converting the Boolean variable or expression in the RSML -e into a Boolean expression in the Luster, traversing the and-or table by column, and constructing a sub-expression for each column, which is formed by the Boolean expressions of the corresponding rows or their logical NOTs connected by logical AND; and connecting the sub-expressions of all columns by logical OR to form the final Luster Boolean expression.

[0059] Specifically, assuming that the Boolean expressions in front of the table are a1, a2, a3...a n , the converted Boolean expressions are A1, A2, A3...A n , and the conversion of the and-or table includes:

[0060] (3-1) traversing the and-or table by column, and forming an expression like expr 1＝ A1 and not A2 and A3...and not An , expr 2＝ not A1 and A2 and notA3......and A n 's sub-expressions;

[0061] (3-2) connect all sub-expressions with or to form a Boolean expression like expr1 or expr2......or expr n .

[0062] (4) for variables, variables are divided into two kinds, one is ordinary variable, one is input variable. The value of ordinary variable depends on the value of other variables in current state or itself or other variables in previous state; the value of input variable does not depend on other variables, except initial value, it is not restricted by other variables. Therefore, in the conversion of variables, the following contents are included: converting the variables of RSML -e model into the nodes of Luster synchronous data flow language.

[0063] According to the embodiment of the present application, the variables of RSML -e model are converted into the nodes of Luster synchronous data flow language, including: for ordinary variable, it is converted into the Luster node with input parameters, using -> symbol and if-else statement to assign initial value and condition, if state transition is involved, the value of previous state is included as condition; for input variable, Luster node is established for it, and the input parameters of main node are used as the input parameters of this node.

[0064] Specifically, for ordinary variable, it is converted into node in Luster, the other variables it depends on are used as the input parameters of this node, and the Boolean expression and and-or table in it are converted into the Boolean expression of Luster synchronous data flow language by using the above method, then the initial value is specified by -> symbol in Luster, and the variable is assigned value by if-else statement. For example, if variable a has initial value b, value d when condition (Boolean expression or and-or table) c is met, value f when condition e is met, otherwise g, a, b, c, d, e, f, g after conversion are A, B, C, D, E, F, G, then the converted variable A is:

[0065] node A (the other variables a depends on are used as the input parameters of this node) returns (result: type (A));

[0066] let

[0067] result = B -> if C then D else if E then F else G;

[0068] tel;

[0069] Note that sometimes a normal variable involves a transition between states, in which case the value of the previous state is added as a condition to the relevant Boolean expression, as in the above variable a with d->b if h, where h is replaced by H, the transformed variable A is:

[0070] node A(a:bool) returns(result:bool)

[0071] let

[0072] result = B->if C then D else if E then F else if pre(result)=D and H then B else G;

[0073] tel;

[0074] For an input variable, it is declared in the input parameters of the main node. But because the input parameters of the main node are assigned randomly in Luster, while the input variable in RSML -e has an initial value, the present application also establishes a node for the input variable, and takes the input parameters of the main node as the input parameters of this node to achieve the effect of assigning the initial value. For example, if the input variable a is a Boolean value and the initial value is true, the transformed variable A is:

[0075] node A(iv_A:bool) returns(result:bool2)

[0076] let

[0077] result = True->if iv_A=true then True then False;

[0078] tel;

[0079] iv_A is declared in the input parameters of the main node:

[0080] node main(iv_A:bool) returns(result:bool)

[0081] Note that the above nodes of normal variables and input variables are all instantiated in the main node.

[0082] The master node is the core of the Luster synchronous data stream language. JKIND only analyzes the properties of the master node, so all other nodes must be instantiated within the master node to be called or used for property analysis. The input parameters of the master node do not depend on other nodes; in other words, their values ​​can be freely changed, so they are used as input parameters for input variable nodes.

[0083] (5) For macros and functions, RSML -e Macros and functions in the model are used to represent combinations of conditional events. This definition method avoids overly lengthy condition tables for a single event. Therefore, the transformation of macros and functions includes the following: converting RSML... -e The model's macros and functions are converted into nodes in the Luster synchronous data stream language.

[0084] According to an embodiment of the present invention, RSML is... -e The model's macros and functions are converted into nodes in Luster's Synchronous Data Streaming Language, including: for RSML -e The macros and functions define Luster nodes, which contain input parameters and return values. They convert the AND-OR table logic within the macros and functions into Luster Boolean expressions and assign the result of the Boolean expression to the node's return value.

[0085] Specifically, a node with a return value of result is created for macros and functions. Other variables that it depends on are used as input parameters for this node. The and-or table in macros and functions is converted into a Boolean expression in Luster synchronous data stream language using the above and-or table conversion method. This Boolean expression is then assigned to result, and this node is instantiated in the main node.

[0086] (6) Flattening issue

[0087] RSML -e The model is a hierarchical model that supports the definition of parent variables or macros and child variables or macros. This is achieved by defining the parent variable or macro and its conditional constraints on the child variable or macro using the `Parent` keyword within the child variable or macro. However, the Luster synchronous dataflow language does not support hierarchy and therefore requires flattening.

[0088] The present invention addresses the flattening problem by including the following: converting RSML... -e The parent variable condition of the model is placed at the beginning of the if-else condition in the Luster synchronous data flow language. The next condition can be judged only if the parent variable condition is satisfied; otherwise, the variable will be in the initial value Undefined.

[0089] The above describes the method proposed in this invention from RSML.-e To better understand the implementation method and advantages of the proposed technical solution, the following section discusses the conversion process from the model to the Luster synchronous data stream language. This is based on the RSML flight guidance system proposed in the literature "Steven P. Miller, Alan C. Tribble, Timothy M. Carlson, and Eric J. Danielson, Rockwell Collins, Cedar Rapids, Lowa. Flight Guidance System Requirements Specification [M]. 2003." -e Taking the model as an example, the conversion method described in this invention is used to convert the model into Luster synchronous data stream language.

[0090] Due to the RSML -e The model is too large, so only a portion of the model is used to illustrate the above invention. (RSML) -e The conversion of the model to Luster synchronous data stream language includes the following:

[0091] Part 1: Type Conversion. Using RSML -e Taking the type Base_State in the model as an example to illustrate type conversion, its RSML -e See model details Figure 3 .from Figure 3 It can be seen that this type is an enumeration type with two selectable values: "Cleared" and "Selected". In the requirement model for automatic flight system mode conversion, it is used to indicate whether a specific flight mode is selected. The steps to convert it to the Luster synchronous data stream language type are as follows:

[0092] 1. Retain the original enumeration type `type Base_State = enum{Cleared, Selected}` for the type of input parameters in the main node;

[0093] 2. Create a new enumeration type `type Base_State2 = enum{cleared, selected, Undefined_Base_State}` to represent RSML. -e The semantic uncertainty that exists in the text.

[0094] 3. Ultimately, this type is converted into two types in the Luster synchronous data stream language, as follows:

[0095] type Base_State=enum{Cleared,Selected};

[0096] type Base_State2 = enum { cleared, selected, Undifined_Base_State}.

[0097] Second part: Conversion of Boolean expressions to RSML -e The conversion of Boolean expressions is illustrated by the Boolean expressions involved in the macro When_Turn_FD_On and the state variable NAV in the model, whose RSML -e The model is detailed in Figure 4 and Appendix 5, where When_Turn_FD_On is used to indicate whether the flight director is on, and NAV indicates whether the navigation mode (NAV) is selected. The conversion method includes:

[0098] 1. The Boolean expression When_FD_Switch_Pressed_Seen in the macro When_Turn_FD_On is converted to When_FD_Switch_Pressed_Seen = True;

[0099] 2. The Boolean expression When (AP = Engaged) in the macro When_Turn_FD_On is converted to AP = engaged;

[0100] 3. The Boolean expression Pilot_Flying = LEFT in the macro When_Turn_FD_On is converted to Pilot_Flying = LEFT;

[0101] 4. The Boolean expression PREVIOU STEP (Mode_Annunciations_On) in the macro When_Turn_FD_On is converted to pre (Mode_Annunciations_On) = True;

[0102] 5. The Boolean expression not Is_This_Side_Active in the state variable NAV is converted to Is_This_Side_Active = False;

[0103] 6. The Boolean expression PREVIOU STEP (NAV_Selected) = Armed in the state variable NAV is converted to pre (NAV_Selected) = armed.

[0104] Third part: Conversion of and-or tables to RSML -e The conversion of and-or tables is illustrated by the and-or table in the macro When_Turn_FD_On in the model, whose RSML-e The model is shown in detail in Figure 4 The conversion to the Luster Synchronous Dataflow Language type is as follows:

[0105] 1. Traverse the and-or table by column, and form the sub-expressions exprl = When_FD_Switch_Pressed_Seen = True, expr2 = AP = engaged, expr3 = Overspeed_Condition = True, expr4 = When_Lateral_Mode_Manually_Selected = True, expr5 = When_Vertical_Mode_Manually_Selected = True, expr6 = (When_Pilot_Flying_Transfer = True and pre(Mode_Annunciations_On) = True and Pilot_Flying = LEFT) for each column T or F corresponding to the Boolean expression of the first column.

[0106] 2. Connect all the sub-expressions with or to form the Boolean expression When_FD_Switch_Pressed_Seen = True or AP = engaged or Overspeed_Condition = True or When_Lateral_Mode_Manually_Selected = True or When_Vertical_Mode_Manually_Selected = True or (m_When_Pilot_Flying_Transfer = True and pre(Mode_Annunciations_On) = True and Pilot_Flying = LEFT).

[0107] Part IV: Conversion of variables to RSML -e The conversion of the state variable NAV and the input variable Offside_FGS_Active in the model is shown below, with the RSML -e The model is shown in detail in Figure 5 and Figure 6 where Offside_FGS_Active indicates whether the flight guidance system (FGS) on the other side is activated.

[0108] For the state variable NAV, as a normal variable, the conversion to the Luster Synchronous Dataflow Language type is as follows without considering its parent variable:

[0109] 1. Create a new node: node NAV(Is_This_Side_Active, Select_NAV, Deselect_NAV, Dearm_NAV, Deactivate_NAV: bool 2; Mode s: onoff 2; Offside_NAV: basestate 2; NAV_Selected: selectedstate 2) returns(result: basestate 2);

[0110] 2. Convert the Boolean expression and and-or table into Luster synchronous data flow language, and use the Luster -> symbol to specify the initial value and use if-else statements to assign values to the variables: result = Undifined_Base_State -> if Is_This_Side_Active = False then Offside_NAV else if pre(result) = Undifined_Base_State and m_Select_NAV = False and Is_This_Side_Active = True then Cleared else if pre(result) = Undifined_Base_State and Select_NAV = True and Is_This_Side_Active = True then Selected else if pre(result) = Cleared and Select_NAV = True and Is_This_Side_Active = True then Selected else if pre(result) = Selected and ((Deselect_NAV = True and Is_This_Side_Active = True) or (Dearn_NAV = True and pre(NAV_Selected) = Armed and Is_This_Side_Active = True) or (Deactivate_NAV = True and pre(NAV_Selected) = Active and Is_This_Side_Active = True)) then Cleared else pre(result);

[0111] 3. The final form in Luster synchronous data flow language is as follows:

[0112] node NAV(Is_This_Side_Active,Select_NAV,Deselect_NAV,Dearm_NAV,Deactivate_NAV:bool2; Mode s:onoff2; Offside_NAV:basestate2; NAV_Selected:selectedstate2) returns(result:basestate2);

[0113] let

[0114] result = Undifined_Base_State -> if Is_This_Side_Active = False then Offside_NAV else if pre(result) = Undifined_Base_State and m_Select_NAV = False and Is_This_Side_Active = True then Cleared else if pre(result) = Undifined_Base_State and Select_NAV = True and Is_This_Side_Active = True then Selected else if pre(result) = Cleared and Select_NAV = True and Is_This_Side_Active = True then Selected else if pre(result) = Selected and ((Deselect_NAV = True and Is_This_Side_Active = True) or (Dearn_NAV = True and pre(NAV_Selected) = Armed and Is_This_Side_Active = True) or (Deactivate_NAV = True and pre(NAV_Selected) = Active and Is_This_Side_Active = True)) then Cleared else pre(result);

[0115] tel;

[0116] For the input variable Offside_FGS_Active, the step of converting it to the Luster Synchronous Dataflow Language type is as follows:

[0117] 1. Create a node Node Offside_FGS_Active(iv_Offside_FGS_Active:bool) returns(result:bool2);

[0118] 2. Assign the initial value with -> symbol in Luster and assign result with input parameter iv_Offside_FGS_Active: result=True->if iv_A=true then True then False;

[0119] 3. Declare iv_Offside_FGS_Active in input parameter of main node: node main(iv_Offside_FGS_Active:bool) returns(result:bool);

[0120] 4. The final form in Luster synchronous data flow language is as follows:

[0121] node Offside_FGS_Active(iv_Offside_FGS_Active:bool) returns(result:bool2);

[0122] let

[0123] result=Undefined->if iv_Offside_FGS_Active=true then True else False;

[0124] tel;

[0125] node main(iv_Offside_FGS_Active:bool) returns(result:bool);

[0126] Fifth, the processing of the flattening problem is illustrated by the state variable NAV in RSML model. -e The RSML model is shown in -e Figure 5 . From Figure 5 ​It can be known that the state variable has a parent variable Modes, and the state variable NAV can migrate to the next state value according to its state transition condition only when Modes = On is established, otherwise the state variable value remains unchanged at its initial value UNDEFINED. Since the Luster synchronous data stream language does not support hierarchical structure, it needs to be flattened. The processing steps are as follows:

[0127] 1. RSML -e The parent variable condition of the model is placed at the beginning of the Luster synchronous data stream language if-else condition, and only when the parent variable condition is met can the next condition be judged, otherwise the variable will be at the initial value Undefined: result = Undifined_Base_State -> if not(Modes = On) then Undefined_Base_State else if Is_This_Side_Active = False then Offside_NAV else if pre(result) = Undifined_Base_State and m_Select_NAV = False and Is_This_Side_Active = True then Cleared else if pre(result) = Undifined_Base_State and Select_NAV = True and Is_This_Side_Active = True then Selected else if pre(result) = Cleared and Select_NAV = True and Is_This_Side_Active = True then Selected else if pre(result) = Selected and((Deselect_NAV = True and Is_This_Side_Active = True) or(Dearm_NAV = True and pre(NAV_Selected) = Armed and Is_This_Side_Active = True) or(Deactivate_NAV = True and pre(NAV_Selected) = Active and Is_This_Side_Active = True)) then Cleared else pre(result);

[0128] 2. Finally, the expression in the Luster synchronous data stream language is as follows:

[0129] node NAV(Is_This_Side_Active,Select_NAV,Deselect_NAV,Dearm_NAV,

[0130] Deactivate_NAV:bool2; Modes:onoff2; Offside_NAV:basestate2; NAV_Selected:selectedstate2) returns(result:basestate2);

[0131] let

[0132] result = Undefined_Base_State -> if not(Modes = On) then Undefined_Base_State else if Is_This_Side_Active = False then Offside_NAV else if pre(result) = Undefined_Base_State and m_Select_NAV = False and Is_This_Side_Active = True then Cleared else if pre(result) = Undefined_Base_State and Select_NAV = True and Is_This_Side_Active = True then Selected else if pre(result) = Cleared and Select_NAV = True and Is_This_Side_Active = True then Selected else if pre(result) = Selected and ((Deselect_NAV = True and Is_This_Side_Active = True) or (Dearn_NAV = True and pre(NAV_Selected) = Armed and Is_This_Side_Active = True) or (Deactivate_NAV = True and pre(NAV_Selected) = Active and Is_This_Side_Active = True)) then Cleared else pre(result);

[0133] tel;

[0134] The final purpose of the present application is to verify the safety properties of RSML -e models, for example, the flight guidance system mentioned above has a property: if this side is active and mode annunciations are off, then when the opposite side FD is on, mode annunciations should be on. It is expressed in Luster synchronous dataflow language as prop1=(pre(Mode_Annunciations_On)=False and pre(Onside_FD_On)=False and Is_This_Side_Active=True and Onside_FD_On=True)=>Mode_Annunciations_On=True; finally, the converted model and the safety property are input into JKIND tool to get Figure 7 the result, which shows that the safety property is consistent.

[0135] Based on the same inventive concept as the method embodiment, in another embodiment of the present application, a conversion system from RSML -e model to Luster synchronous dataflow language is provided, comprising:

[0136] a conversion unit determining module, configured to analyze the RSML -e model, and convert the RSML -e model into basic units of Luster synchronous dataflow language, which are determined as type, Boolean expression, and-or table, variable, macro and function;

[0137] a type conversion module, configured to perform type conversion, for Boolean and enumeration, create a new enumeration type, which contains original values in RSML -e and a specific enumeration value representing undefined; for integer and real, create a structure type containing two elements, one element is an enumeration type indicating whether the value is defined, and the other element stores the actual numerical value;

[0138] a Boolean expression conversion module, configured to perform Boolean expression conversion, a Boolean variable in RSML -e is directly converted into a true value judgment in Luster; a logical NOT in RSML -e is converted into a false value judgment in Luster; a PREVIOUS STEP in RSML -e is converted into a pre() function call in Luster to refer to the state of the previous step; a variable comparison in RSML -e is converted into an equality judgment in Luster, and a variable assignment in RSML -eThe When condition judgment in RSML is also expressed as an equivalent judgment in Luster;

[0139] The and-or table conversion module is configured to perform and-or table conversion, convert a Boolean variable or expression in RSML into a Boolean expression in Luster, traverse the and-or table by column, construct a sub-expression for each column, and connect the Boolean expressions of the corresponding rows or their logical NOTs by logical AND to form the sub-expression; connect the sub-expressions of all columns by logical OR to form the final Luster Boolean expression. -e

[0140] The variable conversion module is configured to perform variable conversion, convert a normal variable into a Luster node with input parameters, use the -> symbol and if-else statements to perform initial value and condition assignment, and if state conversion is involved, include the value of the previous state as a condition; and for an input variable, establish a Luster node and set the input parameters of the main node as the input parameters of this node.

[0141] The macro and function conversion module is configured to perform macro and function conversion, define Luster nodes for the macros and functions of RSML -e , include input parameters and return values, convert the and-or table logic in the macros and functions into Luster Boolean expressions, and assign the Boolean expression results to the return values of the nodes.

[0142] It should be understood that the conversion system from the RSML -e model to the Luster synchronous data flow language provided in the embodiments can implement all the technical solutions in the above method embodiments, and the functions of the various functional modules can be implemented according to the methods in the above method embodiments, and the specific implementation process can be referred to the related descriptions in the above embodiments, which will not be described here in detail.

[0143] The application also provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs are executed by the processor to implement the steps of the conversion method from the RSML -e model to the Luster synchronous data flow language.

[0144] The application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by the processor to implement the steps of the conversion method from the RSML -e model to the Luster synchronous data flow language.

[0145] ​Those skilled in the art will appreciate that embodiments of the application can be devised for a variety of applications. It is to be understood that the application is not limited in its application to the details of construction and the arrangements of components set forth in the following description or illustrated in the drawings. Embodiments of the application are capable of other embodiments and of being practiced or being carried out in various ways. Also, it is to be understood that the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. It should be apparent that the application can be embodied in a variety of forms other than those specifically described or exemplified herein. Specifically, it is to be understood that the drawings and the descriptions thereof are not to be interpreted as limiting the application. The application is intended to cover any alternatives, modifications, equivalents and / or improvements of the application that are within the spirit and / or scope of the application. The present application is directed to one or more various embodiments. In order to avoid

[0146] The present application is described in reference to flow diagrams of methods according to embodiments of the application. It will be understood that each block of the flow diagrams, and combinations of blocks in the flow diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow diagrams block or blocks.

[0147] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flow diagrams block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow diagrams block or blocks.

[0148] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow diagrams block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow diagrams block or blocks.

Claims

1. A method of converting from RSML -e model to Luster synchronous dataflow language, characterized by, The method comprises the following steps: Analyzing the RSML -e model, the RSML -e model is converted to a basic unit of the Luster synchronization dataflow language is determined as a type, a Boolean expression, an and-or table, a variable, a macro, and a function; Type conversion is performed, for boolean and enumeration types, a new enumeration type is created, containing the original values in RSML -e and a specific enumeration value representing undefined; for integer and real types, a structure type is created containing two elements, one element is an enumeration type indicating whether the value is defined, the other element stores the actual numerical value; Boolean expression conversion, RSML -e Boolean variables in RSML are directly converted to truth value tests in Luster; logical NOT in RSML -e is converted to a false value test in Luster; PREVIOUS STEP in RSML -e is converted to a pre() function call in Luster to reference the state of the previous step; variable comparisons in RSML -e are converted to equality tests in Luster; When conditional tests in RSML -e are also expressed as equality tests in Luster; Perform AND-OR table conversion, converting RSML -e The Boolean variables or expressions in the table are converted into Boolean expressions in Luster. The AND-OR table is traversed column by column, and a sub-expression is constructed for each column. The sub-expression is formed by connecting the Boolean expressions of the corresponding row or their logical NOTs through a logical AND. The sub-expressions of all columns are connected through a logical OR to form the final Luster Boolean expression. performing variable conversion, for a normal variable, converting it into a Luster node with input parameters, using -> symbol and if-else statement to perform initial value and conditional assignment, if state conversion is involved, containing the value of the previous state as a condition; for an input variable, establishing a Luster node for it, and taking the input parameters of the main node as the input parameters of this node; Perform macro and function conversion for RSML -e Macro and function definition Luster nodes, containing input parameters and return values, convert and-or table logic within macros and functions to Luster Boolean expressions, and assign the Boolean expression results to the node's return value.

2. The method of claim 1, wherein, when performing type conversion, for a Boolean type, using True and False with the first letter capitalized in the new enumeration type; for an enumeration type, adding enumeration values in the original enumeration type with the first letter capitalized and the case changed to the new enumeration type; for an undefined type, adding different suffixes after Undefined as specific enumeration values of the undefined type to the new enumeration type.

3. The method of claim 1, wherein, when performing and-or table conversion, traversing the and-or table by column, constructing a sub-expression for each column, including: The and-or table is traversed column by column, and the Boolean expression of the first column corresponding to each column True or False is formed into the form expr 1＝ A1 and not A2 and A3......and not A n , expr 2＝ not A1 and A2 and notA3......and A n subexpression.

4. The method of claim 3, wherein, connecting all column sub-expressions through logical or, including: All subexpressions are connected with or to form a Boolean expression of the form expr1 or expr2... or expr n .

5. The method of claim 1, wherein, performing variable conversion, further including: instantiating the nodes of the converted normal variables and input variables in the main node of Luster.

6. The method of claim 1, wherein, performing macro and function conversion, further including: referencing and instantiating the converted macro and function nodes in the main node of Luster.

7. The method of claim 1, wherein, The method further comprises: in the if-else conditional structure of Luster, taking the condition of the parent variable as the primary judgment condition, and only calculating or assigning values to the child variable or macro according to the subsequent conditions when the parent variable condition is satisfied, and setting a default value Undefined for the child variable or macro when the parent variable condition is not satisfied.

8. A system for converting from RSML -e models to Luster synchronous dataflow language, characterized by, The method further comprises: A conversion unit determination module determines the basic units of the RSML -e model to be analyzed, the RSML -e model is converted to the Luster synchronization dataflow language. The basic units determined are types, Boolean expressions, and-or tables, variables, macros, and functions. a type conversion module for performing type conversion, for boolean and enumeration types, creating a new enumeration type containing the original values in RSML -e and a special enumeration value representing undefined; for integer and real types, creating a structure type containing two elements, one element being an enumeration type indicating whether the value is defined or not, and the other element storing the actual numerical value; Boolean expression conversion module for performing Boolean expression conversion, RSML -e Boolean variable in RSML is directly converted to truth value judgment in Luster; RSML -e NOT in RSML is converted to false value judgment in Luster; RSML -e PREVIOUS STEP in RSML is converted to pre() function call in Luster to refer to the state of the previous step; RSML -e variable comparison in RSML is converted to equality judgment in Luster, RSML -e When condition judgment in RSML is also expressed as equality judgment in Luster; and-or table conversion module for converting the Boolean variables or expressions in RSML -e into Boolean expressions in Luster, traversing the and-or table by columns, constructing a sub-expression for each column from the Boolean expressions of the corresponding rows or their logical negations connected by logical AND, and connecting the sub-expressions of all columns by logical OR to form the final Luster Boolean expression; a variable conversion module for performing variable conversion, for a normal variable, converting it into a Luster node with input parameters, using -> symbol and if-else statement to perform initial value and conditional assignment, if state conversion is involved, containing the value of the previous state as a condition; for an input variable, establishing a Luster node for it, and taking the input parameters of the main node as the input parameters of this node; macro and function conversion module for performing macro and function conversion for RSML -e macro and function definition Luster node containing input parameters and return value, converting and-or table logic within the macro and function to a Luster Boolean expression, assigning the Boolean expression result to the return value of the node.

9. A computer device, comprising: The method further comprises: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs, when executed by the processor, implement the RSML-to-Luster synchronization dataflow language conversion method of any one of claims 1-7 -e the steps of the model-to-Luster synchronization dataflow language conversion method.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the method of any one of claims 1-7 for converting RSML -e steps of the method of converting a model into a Luster synchronous dataflow language.

Images